| शीर्षक | kalcaddle / kodcloud kodbox 1.67 build 02 Access Control Check Implemented After Asset is Accessed |
|---|
| विवरण | kodbox 1.67 build 02 contains a missing authorization vulnerability in the default msgWarning plugin. The global route configuration excludes plugin.* routes from login checks, and the msgWarning plugin exposes email notification configuration APIs through /index.php?plugin/msgWarning/action without enforcing administrator authorization. An unauthenticated attacker can call getConfig to read global SMTP/email settings, including stored SMTP credentials, and can call setConfig to modify the SMTP configuration. This may lead to sensitive credential disclosure, persistent mail configuration tampering, trusted system mail abuse, phishing through system mail flows, or disruption of password reset and notification emails. |
|---|
| स्रोत | ⚠️ https://github.com/sjmycz/cve/issues/4 |
|---|
| उपयोगकर्ता | lihongming (UID 98924) |
|---|
| सबमिशन | 11/06/2026 05:32 PM (2 महीनों पहले) |
|---|
| संयम | 03/08/2026 07:42 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 385631 [kalcaddle kodbox 1.67 Build 02 msgWarning Plugin action अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|